CVE-2022-35814

Deeper analysis

CVE-2022-35814 is an elevation-of-privilege vulnerability in Azure Site Recovery. The flaw received a CVSS 3.1 base score of 6.5 with a vector indicating network attack vector, low attack complexity, high privileges required, and no user interaction; successful exploitation can alter or disrupt recovery operations while leaving confidentiality unaffected.

An authenticated attacker already holding high-privileged access to the affected Azure Site Recovery instance can leverage the weakness to obtain further privileges that permit integrity and availability impacts on protected workloads. Because the required privilege level is high, the issue is primarily a concern for administrators or service accounts that manage replication and failover configurations.

Microsoft publishes remediation details and patch availability in its Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35814. The associated EPSS score has remained flat at 0.0631 since disclosure, indicating no material increase in observed exploitation interest.